Looks like you have not read the the small print before using the
Microsoft Outlook app for Android.
Yes, what you have detected is the way the Outlook Android app works. Outlook is not an IMAP client, instead username and password are transmitted to a cloud server (named "Exchange Online") that saves these info and then logs into your mailbox, does what ever it is supposed to do in background and also allows your Outlook app to access your mailbox as well. See also the official documentation by Microsoft on that topic.
I assume access to IMAP folders is only for backward compatibility. The real target of Outlook app is accessing Outlook.com and cloud based Exchange servers. In this scenario the password is not stored on the Microsoft server, instead a generated token is used for user authentication towards the Exchange server. However all your mail, calendar and contact data still passes the Microsoft cloud servers.
BTW: This app and it's backend has not been developed by Microsoft. Instead Microsoft bought a company named "Acompli" and they are the creator of this system.